The mailing list for listmasters using Sympa

[Serge Aumont <address@concealed>]

 Le 12/12/10 23:12, micah anderson a écrit :
> Hi Adam!
>
> On Fri, 10 Dec 2010 15:29:39 -0800, Adam Bernstein<address@concealed>  
> wrote:
> > We're excited to start using Sympa's DKIM feature, but having real trouble
> > getting it working.  I've set all the necessary parameters in sympa.conf,
> > created the DNS record with the public key, etc., and I can get it to sign
> > messages.  But the signatures are apparently not valid; sending them to a
> > DKIM evaluation autoresponder like address@concealed results in
> > a response saying:
> >
> > This is the overall result of the message verification:
> >     fail (message has been altered)
You should be able to check dkim signature of sympa-users messages (1). Is
it OK ?

I don't remember bugs related to DKIM in 6.1.(1,2,3,4). Sympa DKIM 
configuration
is very simple. I doub the problem can comes from wrong parameters. Could it
caused by Mail::DKIM cpan version ?

May be you should try to verify dkim signature using a local script. It 
is just a dozen
of perl line code that can be copied here :
  http://search.cpan.org/~jaslong/Mail-DKIM-0.39/lib/Mail/DKIM.pm

If you catch messages after Sympa send it out you may undersatnd what's 
wrong.

> Hmm.. we have been doing dkim for some time, but we are using
> dkim-milter for outbound signature addition as the message leaves our
> MTA, and it works really well.
>
> I'm curious what the advatage is of having the dkim piece be on the
> sympa side?

First of all, using DKIM features is optional, so you can choose : let 
Sympa sign
messages or leave some MTA adding this signature.

If DKIM signatures are added by Sympa you can do it in a way depending of
list environment. For exemple you can use different parameters depending on
the virtual robot or you can sign messages from robots and not from some 
others
or sign messages only for some list.

You can also decide to signe messages from robot itself (welcome 
messages etc)
and not messages from the list or even more sign a message for the list 
if the
incoming message was authenticated etc.

Serge
PS : Sympa is able to reject a message if it is signed, with ADSP 
discardable and
if the list process will brake the signature.